ISIS Secret Cyber Terrorism Forum Exposed

The forum reflects ISIS hackers' growing desire to wage war online

Hundreds of Islamic State supporters have flocked to an online channel dedicated to providing tools needed to wage campaigns of cyber terror across the Internet.

More than 300 people now belong to an IS-affiliated forum filled with users swapping material on how to target and hack into vulnerable networks and computer systems. Deep Web research firm Vocativ discovered the jihadi e-academy on Telegram, a social messaging app that ISIS supporters have used previously to share instructions on how to make explosive devices, hand grenades, suicide belts and Molotov cocktails.

“This channel is dedicated to publishing courses of hacking and programming languages for the supporters of the Caliphate on the Internet,” reads the forum, which was formed on Nov. 24—less than two weeks after ISIS militants waged an orchestrated massacre in the streets of Paris.

Cyber security experts who reviewed some of the hacker material shared on Telegram said that it doesn’t provide the type of know-how required to carry out the kind of catastrophic cyber attack that many of these experts say is possible. The experts also conceded, however, that it reflects the group’s budding desire to wage increasingly sophisticated warfare online.

“Can they do damage? Sure,” said Herb Lin, a Senior Research Scholar for Cyber Policy and Security at Stanford University. “Can they do the kind of damage that causes all of the lights to go out in New York City? That’s much more difficult to discern.”

The bulk of material published on the ISIS hacker forum consisted of videos and content offered for free elsewhere online. Users, for example, recently shared a free, 27-part course on penetration testing, a practice that involves testing a computer system or network for vulnerabilities that a hacker can exploit.

Nearly all of the tutorials reviewed by Vocativ focused on similar skill sets. Experts said they alone are not enough to do serious damage. “Once you get inside a system you need to know what to do,” said Lars Hilse, a digital strategy consultant who authored a report on cyber terrorism last year. “That requires a certain degree of cleverness that, by itself, presents a hurdle to most people.”

The track record among hackers who claim to be affiliated with ISIS has not displayed that level of proficiency. ISIS supporters failed to follow through on threats they made to infiltrate US security on the anniversary of 9/11 this year and an attempt this month to dox US Senate Minority Leader Harry Reid relied on publicly available information, much of which was outdated or inaccurate, Vocativ found.
    
One of the more celebrated cyber attacks claimed by ISIS came in January when members of its so-called “Cyber Caliphate” managed to hack into US Central Command’s Twitter account. No actual Pentagon network or internal system was breached.

Such achievements are a far cry from any ability to cripple entire financial, military and communication systems, which analysts claim is feasible. And they pale in comparison to some of the recent cyber attacks conducted against the US by hackers based in China and Iran, who have managed to breach government data and gain access to American utility networks.

Yet to dismiss the desire among ISIS supporters to commit “cyber jihad” would be wrongheaded, said Alan Brill, a senior managing director at Kroll, a security consulting firm. Brill and other experts have warned for years that networks containing access to critical information and infrastructure are vulnerable. With a group as well-funded, well-organized and as committed to terror as ISIS on the scene, that’s enough to sound the alarm bells.

“If you just think about the interplay of rising hacker skills on the part of terrorists like ISIS and poor security it leads to the conclusion that there’s a significant amount of risk,” Brill told Vocativ. “To be honest, it scares me.”

Hilse said his own fears were realized in April when a group of hackers brought down a television network in France and infiltrated its website and Facebook page. The hackers claimed allegiance to the Islamic State. If it is proven that ISIS was behind the attack, it would signify a new level of sophistication for the terror group, albeit one that it has not demonstrated since.

“It would mean that ISIS is capable of breaching the cyber-physical threshold and actually getting into the real world,” Hilse said. While he’s cautious about giving credit to ISIS, it still remains a wakeup call.
“I know what the possibilities are if the dots are connected,” he said. “The damage can be potentially dire to our Western way of life.”

Vocativ: http://voc.tv/1VB6ilh

« Biggest Cybersecurity Threats In 2016
Google Chief Says UK Leads In E-commerce »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Frazer-Nash Consultancy

Frazer-Nash Consultancy

Frazer-Nash is a leading engineering, systems and technology company. Areas of expertise include information security and cyber security.

Irish Reporting & Information Security Service (IRISS)

Irish Reporting & Information Security Service (IRISS)

IRISS-CERT is Ireland's first CSIRT (Computer Security Incident Response Team) to provide services to all users within Ireland.

AvePoint

AvePoint

AvePoint is an established leader in enterprise-class data management, governance, and compliance software solutions.

Quantivate

Quantivate

Quantivate is a provider of web-based Governance, Risk, and Compliance (GRC) software and service solutions.

Avast Software

Avast Software

Avast Software is a security software company that develops antivirus software and internet security services.

IT Career Switch

IT Career Switch

An IT Career Switch Traineeship is the easiest way to start a new career in IT or Cybersecurity with fantastic career prospects.

NanoVMs

NanoVMs

NanoVMs is the industry's only unikernel platform available today. NanoVMs runs your applications as secure, isolated virtual machines faster than bare metal installs.

Berezha Security Group (BSG)

Berezha Security Group (BSG)

BSG is a cybersecurity consulting firm specializing in all aspects of application security and penetration testing.

BlackhawkNest

BlackhawkNest

Blackhawk is the only cyber security solution on the market that combines network monitoring and incident response into a cohesive appliance.

Tactic Labs

Tactic Labs

Tactic Labs (part of the Avnon Group) delivers a holistic Cyber-Security Management Platform which provides military-grade protection, safeguarding critical infrastructures and mission-critical data.

SECUINFRA

SECUINFRA

SECUINFRA has been supporting companies in detecting, analyzing and defending against cyber attacks since 2010.

evolutionQ

evolutionQ

evolutionQ delivers quantum-risk management strategies and robust cybersecurity tools designed to be safe in an era with quantum computing technologies.

Responsive Technology Partners

Responsive Technology Partners

Responsive Technology Partners provides superior IT support services including cybersecurity and compliance, telephony, cloud services, cabling, access control, and camera systems.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

LOCH Technologies

LOCH Technologies

LOCH Wireless Machine Vision platform delivers next generation cybersecurity, performance monitoring, and cost management for all 5G and for broad-spectrum IoT, IoMT and OT wireless environments.

at-yet (@-yet)

at-yet (@-yet)

at-yet are an interdisciplinary team of experts. We are all about achieving results, whatever the situation – an acute incident, risk minimisation, safeguarding or data protection.

InQuest

InQuest

InQuest specialize in providing comprehensive network-based security solutions that empower organizations to protect their most critical assets: their people.